← Vulnerability feed

Vulnerability record · CVE-2022-28104 · published 20 May 2022

CVE-2022-28104: Foxit pdf editor unrestricted file upload vulnerability

Foxit · Pdf Editor

Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability.

9.8 CVSS 3.1 Critical EPSS 1.9% · top 21.2% CWE-434 · Unrestricted file upload
9.8CVSS 3.1 base score, v2 7.5
1.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://packetstormsecurity.com/files/166430 ExploitThird Party AdvisoryVDB Entry
https://www.foxitsoftware.com/support/security-bulletins.php Vendor Advisory
https://packetstormsecurity.com/files/166430 ExploitThird Party AdvisoryVDB Entry
https://www.foxitsoftware.com/support/security-bulletins.php Vendor Advisory

Track CVE-2022-28104 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-24954Foxit pdf reader out-of-bounds write vulnerabilityFoxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have a Stack-Based Buffer Overflow related to XFA, for the 'subform colSpan="-2"' a…EPSS 12%9.8CVE-2022-24955Foxit pdf reader uncontrolled search path element vulnerabilityFoxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search Path Element for DLL files.EPSS 1.1%8.8CVE-2025-13941Foxit pdf editor incorrect permission assignment vulnerabilityA local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system pe…EPSS 0.19%8.8CVE-2024-47810Foxit pdf editor use after free vulnerabilityA use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a 3D page object. A specially crafted Javascript code inside a m…EPSS 1.3%8.8CVE-2024-49576Foxit pdf editor use after free vulnerabilityA use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBF_Widget object. A specially crafted Javascript cod…EPSS 1.1%8.8CVE-2024-9254Foxit pdf editor use after free vulnerabilityFoxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code …EPSS 0.88%8.8CVE-2024-7725Foxit pdf editor use after free vulnerabilityFoxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on…EPSS 0.76%8.8CVE-2024-7723Foxit pdf editor use after free vulnerabilityFoxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on…EPSS 0.76%

Source: NIST National Vulnerability Database (record CVE-2022-28104), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.